CVE-2026-56449: Out-of-bounds Write

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68...

PT-2026-103930

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description A Use After Free issue exists in the mod http2 module of the Apache HTTP Server. This occurs via shared session bbtmp re-entrancy, which can lead to memory corruption when the system...

CVE-2026-57941: Use After Free

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-57941: Use After Free

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-63686: NULL Pointer Dereference

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...

CVE-2026-63686: NULL Pointer Dereference

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...

KLA91312 Multiple vulnerabilities in Apache HTTP Server

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability can b...

PT-2026-103936

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description A NULL pointer dereference occurs in the mod xml2enc module. This allows an untrusted backend server to trigger a denial of service by sending a proxied response with a charset that...

PT-2026-103943

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description An integer overflow exists in the mod dav fs module. An authenticated WebDAV client with write access can trigger this issue by sending PROPPATCH requests that declare an excessive number...

CVE-2026-59797: Improper Privilege Management

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

AlmaLinux 9.2 [TuxCare] Security Update: mod_auth_openidc (ALMALINUX9.2:CLSA-2025:1746655009)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746655009 advisory. - modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID...

PT-2026-109951

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-82806: Exposure of Data Element to Wrong Session

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

AlmaLinux 9.2 [TuxCare] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746190792)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746190792 advisory. - Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run...

Apache httpd -- Multiple vulnerabilities

The Apache httpd project reports: limited RCE for some internal redirects to non-CGI files in CGI directories CVE-2026-42356 low moddav shared lock overflow CVE-2026-42528 moderate modheartmonitor denial of service CVE-2026-46729 low modsession: Session cookie not removed during internal redirect...

CVE-2026-59685: Out-of-bounds Write

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-94212: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-42356: Deployment of Wrong Handler

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-58415: Files or Directories Accessible to External Parties

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...